Hi Slava, On Fri, Sep 04, 2009 at 10:10:46PM +0300, Slava Dubrovskiy wrote:
> I trying use nfacctd_renormalize option and use sql_preprocess: usrf=10 [ ... ] > And after as I add "sql_preprocess: usrf=10" it stop write to database. > If I comment sql_preprocess: usrf=10 - working, but not renormalize traffic. > > What is wrong? Is it necessary set sql_preprocess: usrf=10 or > nfacctd_renormalize: true enough? Part of this topic (what is not making the usrf=10 working) was touched in the email i've just sent out, please give it a look. In short: usrf is defined as an action: you need to prepend to it a check, even a dummy one which can be passed by every entry on the queue (ie. minp=1). Give it a try. With regards to renormalization and which way to go, it depends on which NetFlow version you are using. pmacct supports natively only renormalization of NetFlow v5 flows (it means you can set the 'nfacctd_renormalize: true' and that's it). Whereas NetFlow v9 sampling is not natively supported (yet): hence you are forced to go the sql_preprocess (= static) way by explicitely defining the sampling rate by which flows have to be renormalized (and remember to change this parameter at the collector whenever you change it at the exporting devices). Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
